18c368ade1df27e469f2b770c21cd5a8521bcfc3fcc3951fb55e52b5ce1976b1

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65cab2dd4369922f6d35cdfe82015840_JaffaCakes118.html
Size

28KB
MD5

65cab2dd4369922f6d35cdfe82015840
SHA1

a7c9c5321619ed19df4f3f14651f11014e7bfc25
SHA256

18c368ade1df27e469f2b770c21cd5a8521bcfc3fcc3951fb55e52b5ce1976b1
SHA512

ef0ce356d99e47369036b26ef99fa6d1ba24bdbea1fd5edaf1c08e5e52a0421471715458d5a7cd574fffce478eefb3ad6d309e5c06a49cae563146fa433399d7
SSDEEP

192:apflQhiHROFkIdfJZqiPoioEYprJj6bZlooCuQe2VpQGrVMcNGWK4arT8/rVhivt:IflQ64YiPoioEYtJhjuZdG2cNGW/wLB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1180	msedge.exe
1180	msedge.exe
3592	msedge.exe
3592	msedge.exe
4404	identity_helper.exe
4404	identity_helper.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3592 msedge.exe
3592 msedge.exe
3592 msedge.exe
3592 msedge.exe
3592 msedge.exe
3592 msedge.exe
3592 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3592 wrote to memory of 3756	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 3756	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 4624	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1180	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1180	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe
PID 3592 wrote to memory of 1428	3592	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65cab2dd4369922f6d35cdfe82015840_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa808d46f8,0x7ffa808d4708,0x7ffa808d4718
2⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
2⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
2⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
2⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
2⤵
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
2⤵
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
2⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
2⤵
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
2⤵
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5866559700551495213,7983125700043039995,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f268f35629268fdabea50ae73e38323d

SHA1
25f68238d1411b9a5b09144960a09ab46c5eba65

SHA256
51860fd653eebf934d997726ca22772eec638f3cc227b0a5adf62e870b4349cd

SHA512
5dd8a2104d4a4431447aa4da2e239479e9d433b15aef17bfb8eccbfe84ac8d58daef6c5d241fb21ec615fe478da2e9f314e976d4f7c92fc68ad03097fa9ec6a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
a925c76e541f5f16e2f9cf6a65a4eb55

SHA1
fec2ca937de0e48bd0ea15413bfe8f62d8558218

SHA256
a29c1dfc7679263a83cbbc98bd233dc1a8a9eda38e2dc796db607f0868371a48

SHA512
6507b90badcb487fe38117f256d7225707eb90c32e9efeec25a73915153ebb500c54939435ea3ca6b839d8d4260e8804888bedf7346999e4405c3f476f96148f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8aa80ed5d54d6e184554f20ac7d2d474

SHA1
013c753a0c92a95687c9cc09ce750cb6103cd56a

SHA256
1f8d213c2edcfa42637f1596e08b141941db789e35630be35dca8bd087081f30

SHA512
d09a304f45a317ba50672c53782954e0bbc5d666f9372d5957e87b209563efb0d501c2278b66a1c163153d15e484d575cc7fd9acd9880ad34f6a54c65a902996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2cc06f80bac3ae78b7f6025aa84b3505

SHA1
a639e9a6c0fd207c91b787d47de382276de55b94

SHA256
a8f111dbd0afcaf5b9a8163cc0ca0e205c2d52e7a2462343e96317084cc82443

SHA512
3fcede3204215d702fd1b5ca4a9eda91ccf3323394694b9b629d73b01b2b96f88a48ad057493721fb7ed6783ffacb1f48b73217c2d04756430450825f6f3feb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
147912c2913d732a4d83eded39e7aaf9

SHA1
bd6378708b257ca6d2f1a35bb381eeea12903076

SHA256
3aeccddcc21034b864a4d7b0abfe1f5446e55e192bb4bca0a648522cc7a07b4c

SHA512
75e466d3c6490ac5366c153753edd7dba05a753b1333d9c91ebd185c046dee81820f793e520c4d45eeefbef6e63490bcdae867d8d479723aa792b78070422068

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
babbfcfdd332d09d7a77018c7efcd272

SHA1
afcbe533b0d0088199c5c214f2be89347c5f7078

SHA256
a0294d03be22a97719f1ffe5319c4b1b9508c3e18153ccb1178d3caccfe492a5

SHA512
d92055cf35f9e437de5627756de2e674d4cd843b1b1b9e96da781a68be65ac1619bee92a4abffe754a548b4207b8a44d67b5f09d2e0416131962c603f2c18053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7f58fddd961e0fedf39dec18b6e345a

SHA1
fe502fefb495c79e61078330b17327d103a00612

SHA256
171ada70bc0aa7087e3c644f506928533ed43e5d8b852b9673ef247fde44ecd3

SHA512
6f14ee9236adcbdf2772c39fb67d4ea1355c7b5f4ef9440eb00b75409561137202967e8c1e8ca020e315b4baba39b2e1647c20f0da6e973ca307b87310d8a947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
03cad726df3833fde8e6f1c04da2e525

SHA1
cd7bbb5e3c5f5e10c2a32561304d6c297b8aa50d

SHA256
f63312b76ef2ddf8175294546b665cd0f57a4ea3e3531c84a6e189d1488d7e68

SHA512
55c607cffc241613cb5214a491cf9fb9d48f31317d47f9a47cc26d8f1e66f53134dad15c73577131b1359381f35eca842aa1b9f668ac180ced092ce5efbf8ff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d62c.TMP

Filesize
204B

MD5
4fd43a90701ecac1cebdf1bdb3dff797

SHA1
c5060bbca52899f56ec613e6798443e213260c43

SHA256
5ffc61d61a41a324e847c46e0179799500272d6ecb12ac41f8fc786b500849e9

SHA512
01c6acafe27a64d8444e0518c5cd74caf93767f6ad1f6f948374ba3845f9b7cd5dd6a02646302bc7ea6d12d8846179a73ffd599ca814d6a2beb1175312ca6da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a3ea4fe5ace605afe11a1b1da53414ca

SHA1
7cbecadf696c8b4a98610f0cc7d142c14216a6b5

SHA256
c50113df9abc7675ac57c1b117c666a88e7efdaa9941d0189498e6b1e2cc31bf

SHA512
7647ba85db1fce6cce4c4c450b65feda5127c37656c8f16f33d68934f87dd3f670305bc494d35e835a661666f44ec6984388e981a70953280b94a5dfba1531de

Download Submit
\??\pipe\LOCAL\crashpad_3592_IEZIVURRTYFQXHSV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit